Claims: We claim: 

1) An unsolicited message diverting communications processor connected to 
mail transfer agents 

MTAO with an Internet address of IP_0, from-address A O, declared domain of DO, 
and actual domain of DDO, and 

MTA_1 with an Internet address of IPl, to-address A_l, diversion address AM, 
and save_spam database 
comprising: 

a) monitoring means for monitoring the communications between MTA_0 and MTA_1 ; 

b) determining means for determining if the communications contains an unsolicited 
message; and 

c) intercepting means for 

intercepting a RCPT reply from MTA_0, 

substituting diversion address AM for to-address A_l in RCPT reply and 

sending modified RCPT reply to MTA J 
if the message is determined to be unsolicited and if to-address is in the 
save_spam database; 

whereby MTA_1 controls the interaction between MTA_0 and MTA_1 before a RCPT 
command from MTA_0 is received and 

whereby the connection with MTA_0 is rejected before the data portion of the unsolicited 
message is transmitted. 

2) The unsolicited message blocking communications processor in Claim 1, further 
includes a allow_address database and wherein the determining means determines if 
a message is not unsolicited by checking if the IP_0 is in the allow_address database. 

3) The unsolicited message blocking communications processor in Claim 1, further 
includes a prevent_address database and wherein the determining means determines 
if a message is unsolicited by checking if IP O is in the prevent_address database. 

4) The unsolicited message blocking communications processor in Claim 1, further 
includes access to a open relay database and wherein the determining means 
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determines if a message is unsolicited by checking if IP_0 is in the open relay 
database. 

5) The unsolicited message blocking communications processor in Claim 1, further 
includes access to a DNS (domain name server) database and wherein the 
determining means determines if a message is unsolicited by checking if IP_0 has a 
domain name DD_0 in the DNS database. 

6) The unsolicited message blocking communications processor in Claim 1, further 
includes a bad_from database and wherein the determining means determines if a 
message is unsolicited by checking if the from-address A_0 is in the bad_from 
database. 

7) The unsolicited message blocking communications processor in Claim 11, further 
includes a suspect_domain database and wherein the determining means determines 
if a message is unsolicited by checking if the actual domain DD_0 matches the 
domain of from-address A_0 and the domain of from-address A_0 is in the 
suspect_domain database. 

8) The unsolicited message blocking communications processor in Claim 1, wherein the 

determining means determines if a message is unsolicited by checking if the from- 
address A_0 matches the to-address A_l. 

9) The unsolicited message blocking communications processor in Claim 1, wherein the 

determining means determines if a message is unsolicited by checking if the declared 
domain D_0 of MTA_0 is the same as the domain D_l of MTA_1. 

10) The unsolicited message blocking communications processor in Claim 1, wherein the 
determining means determines if a message is unsolicited by checking if the declared 
domain D_0 of MTA_0 does not match the real domain DDI and the declared 
domain D_0 is in the suspect_domain database. 

11) The unsolicited message blocking communications processor in Claim 1, further 
includes a no_filter database and wherein the determining means determines if an 
unsolicited message should be blocked by checking if to-address A_l is in the 
no_filter database. 

12) The unsolicited message blocking communications processor in Claim 1, further 
includes a rejected connection database which logs the time, from-address A_0, to- 
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address A_l, and the reason for the rejection if a message is rejected if the message 
is determined to be unsolicited. 
13) The unsolicited message blocking communications processor in Claim 11, further 
includes a allowedconnection database which logs the time and to-address A_l if 
the message is determine not to be unsolicited. 
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14) A method for 

a receiving networked computer system with an Internet connection, a mail 
transport agent MTA_1, an Internet address IP l, to-address A__l, a diversion 
address A'l, a save_spam database and an operating system capable of executing 
the method 

to divert unsolicited messages from 

a transmitting networked computer system with an Internet connection and a mail 
transfer agent MTA_0, an Internet address IP O, from-address A_0, declared 
domain D_0, and actual domain DD_0 

comprising the steps of: 

a) waiting for a new SMTP connection request; 

b) relaying and monitoring the replies from MTA_0 to MTA_1; 

c) relaying replies from MTA_1 to MTA_0; 

d) intercepting the RCPT reply from MTA_0 to MTAl ; 

e) determining if the message is unsolicited by analyzing the monitored replies; 

f) releasing the intercepted RCPT reply if the message is determined not to be 
unsolicited; and 

g) substituting diversion address AM for to-address A_l in the RCPT reply and sending 
the modified reply to MTA_1 if the message is determined to be unsolicited and if 
recipient address A_l is in the save_spam database; 

whereby MTA l controls the interaction between MTA_0 and MTAl before a RCPT 
command from MTA_0 is received and 

whereby the connection with MTA_0 is rejected before the data portion of the unsolicited 
message is transmitted. 
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15) A method for 

a receiving networked computer system with an Internet connection, a mail 
transport agent MTAl, IP address HM, a domain name D_l, a recipient, 
A_l, a recipient diversion address AM, an allow_address database, a 
prevent_address database, a suspectdomain database, a bad_from database, a 
no_filter database, a rejected connection database, an allowedconnection 
database, and an operating system capable of executing the method 
to divert unsolicited messages from 

a transmitting networked computer system with an Internet connection, a mail 
transfer agent MTA_0, an IP address of IPO, a declared domain name D_0, 
a real domain name DD_0, and a sender address of A_0 

comprising the steps of: 

a) waiting for a SMTP connection request on the receiving networked computer 
system's Internet connection; 

b) sending a 220 reply to MTA_0 to acknowledge the requested connection; 

c) extracting IP_0 from the connection request; 

d) requesting the real domain name DD_0 for IP_0 from a DNS database; 

e) testing if the real domain name DD_0 is "no name"; 

f) testing if IPO is in an open relay database; 

g) testing if IP O is in the allow_address database; 

h) testing if IP_0 is in the prevent_address database, 

i) requesting a connection with MTA_1 ; 

j) waiting for a 220 reply from MTA 1 to acknowledge the requested connection; 

k) waiting for a reply from either MTA_0 or MTA_1 ; 

1) jumping to step o) if the reply is not from MTA_1 ; 

m) relaying the reply from MTA_1 to MTA O; 

n) jumping to step k) to wait for a new reply; 

o) jumping to step u) if the reply from MTA_0 is not a HELO; 

p) extracting domain D_0 from the reply; 

q) testing if the declared domain DO is the same as D_l ; 
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r) testing if the declared domain DO of MTAO does not match real domain DDO of 
MTAJ) AND the declared domain DO of MTA_0 is in the suspect_domain 
database; 

s) relaying the HELO reply from MTAJ) to MTA_1 ; 

t) jumping to step k) to wait for a new reply; 

u) jumping to step aa) if reply from MTA_0 is not a MAIL; 

v) extracting from-address A J); 

w) testing if A O is in the badjrom database; 

x) testing if DD O does not match the domain of A_0 and the domain of A_0 is in the 

suspect_domain database; 
y) relaying MAIL reply to MTA_1 ; 
z) jumping to step k) to wait for a new reply; 
aa) jumping to step qq) if reply from MTA O is not a RCPT; 
bb) extracting to-address A_ 1 ; 
cc) testing if A J is in the no Jilter database; 
dd) testing if A O matches A 1 ; 

ee) jumping to step nn) if t_allow OR t_no_filter OR NOT ( t_prevent OR t_open OR 

t_DD_0 OR t_bad_from OR t_suspect_domain OR t_match ); 
ff) logging time, A J), A J, and reason for rejection in rejected_connection database; 
gg) jumping to step 11) if A 1 is not in the save_spam database; 
hh) looking up A' J in the diversion database; 
ii) substituting A' J for A 1 in the RCPT reply; 
jj) sending the modified RCPT reply to MTA_1; 
kk) jumping to step k) to wait for a new reply; 
11) rejecting MTAO connection by sending a 550 reply to MTAO; 
mm) jumping to step k) to wait for a new reply; 
nn) logging time and A_l in allowed_connection database; 
oo) relaying RCPT from MTAJ) to MTAJ ; 
pp) jumping to step k) to wait for new reply; 
qq) jumping to step bbb) if reply from MTAJ) is not DATA; 
rr) relaying DATA reply to MTAJ ; 
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ss) waiting for a 354 reply from MTAJ ; 

tt) relaying the 354 reply from MTA l to MTA_0; 

uu) waiting for the data from MTA_0; 

vv) relaying the data from MTAJ to MTA l ; 

ww) waiting for a ,\r\n from MTAJ; 

xx) relaying the .\r\n from MTA_0 to MTA l ; 

yy) waiting for a 250 reply from MTA_1 ; 

zz) relaying the 250 reply to MTA_0; 

aaa) jumping to step k) to wait for a new reply; 

bbb) jumping to step eee) if reply from MTA_0 is not RSET, SEND, SCML, SAML, 

VRFY, NOOP, EXPN, HELP, or TURN; 
ccc) relaying reply to MTA_1; 
ddd) jumping to step e) to wait for a new reply; 
eee) jumping to step jjj) if reply from MTAJ is not a QUIT; 
fff) relaying the QUIT reply to MTAJ; 
ggg) waiting for 221 reply from MTAJ 
hhh) relaying 221 reply from MTAl to MTAJ; 
iii) jumping to step a) to wait for a new connection; 
jjj) sending a 500 reply to MTAJ) to signal a syntax error; and 
kkk) jumping to step a) to wait for a new connection. 
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